the parameter value is not valid. in loading image from data base

Question

0.00/5 (No votes)

See more:

hi bax
i have problem in loading an image from sqlserver2088 r2 please help me
my code has this error : the parameter value is not valid.

its my code:

C#

string pic = "select PIC from _TRBS_PIC WHERE SERIAL = '" + fieldTxt1.Text + "';
SqlDataAdapter sda = new SqlDataAdapter(pic, sqlCnn);
DataTable dt = new DataTable();
sda.Fill(dt);
if (dt.Rows.Count>0)
{
    byte[] imageBytes = new byte[0];
    imageBytes = (byte[])dt.Rows[0][0];
    MemoryStream ms = new MemoryStream(imageBytes);
    picBoxUser.Image = Image.FromStream(ms); // the parameter value is not valid
}

Posted 30-Oct-13 0:36am

fatima...68

Updated 30-Oct-13 1:01am

Thomas ktg

v2

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

OriginalGriff · Answer 1 · 2013-10-30T01:05:00

Solution 1

It's probably how you stored the data in the first place. See here: Why do I get a "Parameter is not valid." exception when I read an image from my database?[^]

Posted 30-Oct-13 1:05am

OriginalGriff

Comments

fatima...68 30-Oct-13 7:41am

thanks i did it and i fix my insert command but i have that error yet

OriginalGriff 30-Oct-13 10:54am

And did you fix the values in your database as well?
Because fixing the INSERT will not affect existing values...

fatima...68 31-Oct-13 1:41am

thanks my firiend
what do you mean

OriginalGriff 31-Oct-13 2:46am

I mean that fixing the INSERT command fixes images you as to the database from now on. It doesn't fix images you added to the DB before you changed the way you did INSERTs - you have to delete all the old, faulty images from the DB before you start adding new images that will work.

fatima...68 31-Oct-13 4:39am

yes i did this
i delete old image and insert the new image
this is my insert code
pic_count = Directory.GetFiles("c:\\OMEGA\\kaj" , "*.Bmp", SearchOption.AllDirectories).Length;
string[] fileInDir = new string [pic_count];
string[] NAM = new string[pic_count];

fileInDir = Directory.GetFiles("c:\\OMEGA\\kaj", "*.Bmp", SearchOption.TopDirectoryOnly);

int l = fileInDir.ToString().Length;
int index = 0;

for (int i = 0; i < pic_count; i++)
{
index = fileInDir[i].ToString().LastIndexOf("\\");
if (index > -1)
{
NAM[i] = fileInDir[i].ToString().Substring(index + 1);
}

IMG = Image.FromFile("c:\\OMEGA\\kaj\\" + NAM[i] + "");
byte[] data;
using (MemoryStream ms = new MemoryStream())
{
IMG.Save(ms, System.Drawing.Imaging.ImageFormat.Bmp);
data = ms.ToArray();
}
picBoxUser.Image = IMG;

string num = "select SERIAL from _TRBS_PIC where SERIAL = '"+int.Parse(NAM[i].Replace(".Bmp",""))+"' ";

SqlDataAdapter dp = new SqlDataAdapter (num , sqlCnn);
DataTable tp = new DataTable ();
dp.Fill(tp);

if (tp.Rows.Count>0)
{
p_num = int.Parse(tp.Rows[0][0].ToString());
}

if (tp.Rows.Count <= 0)
{
try
{
double max;
DateTime d;
SqlCommand cmdDateTime = new SqlCommand("Select getdate() ", sqlCnn);
sqlCnn.Open();
d = DateTime.Parse(cmdDateTime.ExecuteScalar().ToString());
sqlCnn.Close();
SqlCommand cmdCount = new SqlCommand("Select Count(_ID) from _TRBS_PIC ", sqlCnn);
sqlCnn.Open();
double No = double.Parse(cmdCount.ExecuteScalar().ToString());
sqlCnn.Close();
if (No == 0) max = 1000 + StID;
else
{
SqlCommand cmdMax = new SqlCommand("Select max(_ID) from _TRBS_PIC ", sqlCnn);
sqlCnn.Open();
max = double.Parse(cmdMax.ExecuteScalar().ToString());
max = max % 1000;
max = double.Parse(cmdMax.ExecuteScalar().ToString()) - max + 1000 + StID;
sqlCnn.Close();
}
ID = max;
string strsql = "INSERT INTO _TRBS_PIC ([_ID]"
+ ",[SERIAL]"
+ ",[DATE]"
+ ",[PIC]"
+ ",[NUM]"
+ ",[DETAIL]"
+ ",[ESERIAL]"
+ ",[UID1]"
+ ",[UID2]"
+ ", [_LastSecurityOption], [_LastSaveOption], [_LastDate], [_LastTime], [_LastDateTime], [_LastUID], [_LastStID], [_LastStatus]) values ('"
+ max.ToString()
+ "','" + NAM[i].Replace(".Bmp","")
+ "','" + fieldTxt2.Text
+ "','" + picBoxUser.Image
+ "','" + pic_count
+ "',' "
+ "','0"
+ "','" + UID1.ToString()
+ "','" + UID2.ToString()
+ "','0','0','" + d.ToShortDateString().ToString() + "','" + d.ToShortTimeString().ToString() + "','" + d.ToString() + "','" + UID.ToString() +

OriginalGriff 31-Oct-13 5:08am

What part of the Tip I pointed you to did you actually read?
If you did read it, you would see that the problem is your code:
+ "','" + picBoxUser.Image
Stop concatenating strings to form SQL commands! It is extremely dangerous as it allows users to damage or destroy your database using SQL Injection attacks, as weel as causing the problem you are experiencing!

Now go back, read the tip, and do what it says. And get rid of that string concatenation and use all parameterised queries before you best mate finds out and deletes your tables just to see the look on your face...

fatima...68 31-Oct-13 5:21am

CAN YOU EXPLANE MORE?
i cant understand

OriginalGriff 31-Oct-13 5:47am

When you create a string with an SQL command in it:
string sql = "INSERT INTO MyTable (myColumn) VALUES ('" + textString + "')";
you are concatenating strings: adding them together. What that does is form a larger string. So if textString contains "Hello" than teh string you pass to SQL looks like this:
INSERT INTO MyTable (myColumn) VALUES ('Hello')
and all is fine. But...what if I come along and don't type "Hello", but type this instead:
Hello');DROP TABLES MyTable;--
The string you end up passing to SQL is then:
INSERT INTO MyTable (myColumn) VALUES ('Hello');DROP TABLES MyTable;--')
Which SQL sees as three separate commands:
INSERT INTO MyTable (myColumn) VALUES ('Hello');
DROP TABLES MyTable
;--')
The first inserts the value, the second deletes the table and all it's content, and the third comments out the rest of the line.
Or perhaps you do this:
string sql = "SELECT userID FROM Logins WHERE UserName='" + textbox1.Text + "' AND Password='" + textbox2.Text + "'";
What happens if I type my user name as:
Admin';--
Answer - I log in as the administrator and I don't need a password...

These are called SQL Injection attacks, and if you concatenate strings, you leave yourself wide open to them. Always, always use parametrised queries!

fatima...68 2-Nov-13 3:47am

hi my friend
oh my fiend thank you thank you thank you thank you thank you thank you very much
i did it and now its working thank you very very much

OriginalGriff 2-Nov-13 5:22am

You're welcome!